AWS eks medium security documentation change
Summary
Added options to disable session tags and configure session policies for Pod Identity
Security assessment
Introduces security controls for IAM permissions: disabling session tags reduces attack surface, while session policies enable stricter permission boundaries than the base IAM role, enforcing least privilege.
Diff
diff --git a/eks/latest/userguide/pod-id-assign-target-role.md b/eks/latest/userguide/pod-id-assign-target-role.md index c2f82576f..5f5f15b50 100644 --- a//eks/latest/userguide/pod-id-assign-target-role.md +++ b//eks/latest/userguide/pod-id-assign-target-role.md @@ -190 +190,9 @@ In this step, you will create an association between the Target IAM role and the - 9. Choose **Create** to create the association. + 9. (Optional) Select **Disable session tags** to disable the default session tags that Pod Identity automatically adds when it assumes the role. + + 10. (Optional) Toggle **Configure session policy** to configure an IAM policy to apply additional restrictions to this Pod Identity association beyond the permissions defined in the IAM policy attached to the **Target IAM role**. + +###### Note + +1\. A session policy can only be applied when the **Disable session tags** setting is checked. 2. If you specify a session policy, then the policy restrictions apply to the **Target IAM role** 's permissions and not the **IAM role** associated with this Pod Identity association. + + 11. Choose **Create** to create the association.